GDPR and data protection

Who we are

Tolayda is operated by LaunchPad Labs Limited (company number 17137093), registered in England and Wales, with its registered office at 20 Bulford Close, Hucclecote, Gloucester, England, GL3 3AG. ICO registration number: ZC198000.

Where data is stored

Your files are stored in the EU, translation runs on our own servers in the UK, and your content is never sent to any other AI company.

Tolayda runs on Vercel and Supabase in the EU, which hold accounts, papers and translations. Translation itself happens on servers we operate ourselves in the UK, reached through Cloudflare's secure network. Documents are never sent to the developer of the translation model or to any other AI provider. A few service providers, such as Microsoft for university sign-in, may access limited data from outside the UK and EU, and those transfers are covered by UK adequacy regulations or approved contract terms.

Roles

• Papers uploaded and translations made under a licence: your university is the controller, and LaunchPad Labs is the processor, under the data processing agreement.
• Account, security, service and billing data: LaunchPad Labs is the controller.
• Product update emails to users: LaunchPad Labs is the controller.
• Everything on free student accounts (no licence): LaunchPad Labs is the controller.

Data processing agreement

Clause 9 and Schedule 3 of our service agreement are our data processing agreement under Article 28 of the UK GDPR. They cover the subject matter, duration, nature and purpose of processing, data types, data subjects, sub-processors, security, breach notification, audits and deletion. If your university prefers a standalone data processing agreement, or wants to use its own template, ask us at hello@tolayda.com.

Sub-processors

Universities authorise the sub-processors below when they sign. We give at least 30 days' written notice of any change, and you may object on reasonable grounds.

• Vercel: application hosting and cookieless page analytics. Where: EU (Paris region); may involve US access.
• Supabase: sign-in, database and file storage. Where: EU.
• Cloudflare: secure connection to our UK translation servers; document content passes through it. Where: Cloudflare network; may involve US access.
• Microsoft (Entra ID): university sign-in, and importing files from OneDrive when a user chooses to. Where: may involve US access.
• Resend: email delivery and email preferences. Where: may involve US access.
• Sentry: error reporting and performance tracing. Where: EU; may involve US access.
• Slack: internal notifications to our team about translation reports, including any excerpts attached to them, and university introductions. Where: may involve US access.

Transfers outside the UK or EEA rely on UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, depending on the provider.

Translation model

During the beta, translation runs on an open translation model that we have optimised for academic writing and operate ourselves. From full release, it runs on SeventyTwo, our own model. Your documents are not sent to the developer of the model or to any other AI provider.

Content from licensed universities is used to train our translation model only where the university's agreement allows it.

Emails to your users

We send service emails, such as sign-in, security and help messages, on your university's instructions. We may also send users occasional product update emails about new Tolayda guides, languages and features. These are switched on by default; users can turn them off at any time on the Account page or with the unsubscribe link in the email, and doing so never affects their use of Tolayda. We never share users' details with anyone else for marketing.

Special category data

We do not intentionally process special category data. Users should not upload patient-identifiable health data or other special category data unless the university has authorised it and appropriate controls are in place.

Retention and deletion

• Your university sets retention during the contract, up to a maximum of six years from when content was created.
• An account not used for twelve months is archived after at least 30 days' warning to the user, and restored if they sign in again.
• When the contract ends, you have 90 days to export your data in a machine-readable format at no extra cost. We then delete it, including from backups in line with our backup cycle, and confirm deletion in writing on request.
• Users can permanently delete their own papers, translations and files at any time, or their whole account from the Account page.

Security

• Encryption in transit and at rest
• Role-based access control and least privilege for our staff
• Single sign-on with Microsoft Entra ID, so users who sign in with their university account never give us their university password
• Regular backups, with restore testing at least once a year
• A documented information security policy and staff training
• A documented incident response and breach notification procedure
• Independent penetration testing, the first within twelve months of our first university contract, then at least once a year

Certifications

• Cyber Essentials: held, valid to 25/08/2027
• ICO registration: registered, ZC198000
• ISO/IEC 27001: in progress
• ISO/IEC 42001: in progress

Breach notification

We notify the university without undue delay, and in any event within 72 hours of becoming aware of a personal data breach affecting its data, with the information it needs to meet its own obligations under Article 33 of the UK GDPR.

Audits

We make available the information needed to show we meet our obligations and allow audits, including inspections, on reasonable notice, up to once a year, or more often after a personal data breach.

Supporting your DPIA

We can provide an architecture summary, our security controls, the sub-processor list and completed security questionnaires to support your data protection impact assessment.

Data subject requests

Individuals using Tolayda under a licence should contact their university, as controller. We help universities respond within the time the law allows. Free student account users can contact us directly at hello@tolayda.com.

Contact

For a data processing agreement, the sub-processor list, security documentation or any data protection question, email hello@tolayda.com.